Ipam Ddi

---
name: ipam-ddi
description: "Cross-platform comparison and architecture guidance for IPAM, DNS, and DHCP (DDI) technologies: IP address lifecycle management, DNS architecture, DHCP fingerprinting, Grid/HA topologies, and DDI platform selection. Use for \"IPAM\", \"DDI\", \"IP address management\", \"DNS DHCP IPAM\", \"DDI comparison\", \"DDI architecture\", \"IP allocation\", \"subnet management\", \"DDI migration\". Do NOT use for infoblox- or efficientip-specific configuration -- use that technology's own skill."
license: MIT
---

# IPAM/DDI

This skill covers all IPAM, DNS, and DHCP (DDI) technologies, providing cross-platform expertise in IP address lifecycle management, DNS service architecture, DHCP design, DDI integration patterns, and platform selection. Sibling technology skills provide deep implementation details.

## When to Use This Skill vs. a Technology Skill

**Use this skill when the question is cross-platform or architectural:**
- "Which DDI platform should we deploy for a 5,000-site enterprise?"
- "How should I design my IP address management strategy?"
- "Compare Infoblox and EfficientIP for our requirements"
- "What is DDI and why does it matter?"
- "Plan a DDI migration from spreadsheets to a platform"
- "How do DNS, DHCP, and IPAM work together?"
- "Best practices for subnet allocation and IP lifecycle"

**Route to a technology skill when the question is platform-specific:**
- "Configure a WAPI call to create a host record" --> the `infoblox` skill
- "Set up Infoblox Grid replication" --> the `infoblox` skill
- "EfficientIP SOLIDserver Terraform provider" --> the `efficientip` skill
- "DNS Guardian DDoS countermeasures" --> the `efficientip` skill

## How to Approach Tasks

1. **Classify** the request:
   - **Platform selection** -- Load `references/concepts.md` for DDI fundamentals, then compare platforms below
   - **Architecture / Design** -- Apply DDI integration principles and IP address management best practices
   - **Migration** -- Identify source and target platforms, assess data export/import paths
   - **Troubleshooting** -- Identify the DDI platform, consult the technology skill
   - **IP addressing** -- Apply subnet design, VLSM, RFC 1918 / RFC 6598 guidance

2. **Gather context** -- Deployment scale (sites, subnets, IP count), DNS query volume, DHCP scope count, regulatory/compliance needs, cloud vs on-premises, existing CMDB/ITSM tooling, automation maturity

3. **Analyze** -- Apply DDI-specific reasoning. Consider centralized vs distributed DNS, DHCP failover models, IP address exhaustion risks, and audit/compliance requirements.

4. **Recommend** -- Provide guidance with trade-offs across platforms

5. **Qualify** -- State assumptions about scale, deployment model, and operational maturity

## DDI Fundamentals

### Why DDI Matters

DNS, DHCP, and IPAM are the three foundational network services every device depends on. Managing them in silos (separate tools, spreadsheets for IPAM) creates operational risk:

- **IP conflicts** from uncoordinated allocation
- **Stale DNS records** from manual cleanup
- **DHCP exhaustion** from unmonitored scope utilization
- **Audit gaps** for compliance (who had which IP when?)
- **Slow provisioning** from manual workflows

An integrated DDI platform automates the lifecycle: DHCP assigns an IP, DNS records are created automatically, and IPAM tracks the full history.

### DNS Architecture Patterns

| Pattern | Description | Use Case |
|---|---|---|
| **Authoritative + Recursive** | Separate roles for serving zones vs resolving queries | Most enterprise deployments |
| **Split DNS** | Different zone views for internal vs external clients | Public/private zone separation |
| **DNSSEC** | Cryptographic zone signing for integrity | Compliance, high-security environments |
| **Response Policy Zones (RPZ)** | DNS firewall for threat blocking | DNS-layer security |
| **DNS64** | Synthesize AAAA from A for IPv6 transition | Dual-stack networks |

### DHCP Design Considerations

| Design Element | Best Practice |
|---|---|
| **Failover** | Always deploy DHCP in HA pairs (active/standby or load-balanced) |
| **Scope sizing** | 20% headroom minimum in each scope |
| **Lease time** | 8 hours for wired, 1-4 hours for wireless, 30 min for guest |
| **Fingerprinting** | Enable DHCP fingerprinting for device classification and NAC integration |
| **Option 43/60** | Vendor-specific options for IP phones, APs, printers |
| **Relay agents** | ip helper-address on every L3 interface; ensure relay reaches both HA members |

### IP Address Management Best Practices

1. **Hierarchical allocation** -- Region > Site > Building > VLAN/Subnet tree
2. **RFC 1918 / RFC 6598** -- Use 10.0.0.0/8 for enterprise; 100.64.0.0/10 (CGN) for service provider/cloud overlay
3. **Subnet standardization** -- /24 for access, /30 or /31 for point-to-point, /27-/28 for DMZ
4. **Extensible attributes** -- Tag every IP with owner, location, environment, purpose
5. **Automated discovery** -- SNMP, ARP, and DHCP-fed IPAM to eliminate manual tracking
6. **Conflict detection** -- Enable real-time duplicate IP detection
7. **Reclamation** -- Periodic sweep of unused IPs; automated after lease expiry + grace period

## Platform Comparison

### Infoblox vs EfficientIP

| Dimension | Infoblox NIOS / BloxOne | EfficientIP SOLIDserver |
|---|---|---|
| **Architecture** | Grid (GM + Members) + SaaS (BloxOne) | Primary/Secondary appliance + SaaS |
| **Threat Defense** | BloxOne Threat Defense (extensive) | DNS Guardian (DDoS/tunneling focus) |
| **API** | WAPI (mature, REST) + Universal DDI API | REST API + ecosystem connectors |
| **IaC** | Terraform + Ansible (mature) | Terraform + Ansible |
| **DNSSEC** | Full (ZSK/KSK automation) | Full |
| **DDoS Defense** | RPZ + DNS security feeds | DNS Guardian (hardware-accelerated) |
| **Multi-tenancy** | Views + MDM-style domains | Multi-tenant architecture |
| **Market position** | Dominant enterprise DDI | Strong European market; DDoS specialization |
| **SaaS option** | BloxOne DDI (mature) | EfficientIP Cloud DDI |
| **ITSM integration** | ServiceNow, BMC | ServiceNow native connector |
| **Migration tooling** | N/A (incumbent) | Infoblox migration tools available |

### Platform Selection Guide

```
Is DNS-layer security (threat defense) a primary requirement?
  Yes -> Infoblox (BloxOne Threat Defense is market-leading)
  
Is high-performance DNS DDoS protection the priority?
  Yes -> EfficientIP (DNS Guardian hardware-accelerated)

Is the environment primarily cloud/SaaS?
  Yes -> Infoblox BloxOne DDI (most mature SaaS DDI)

Is budget constrained with strong European presence?
  Yes -> EfficientIP (competitive pricing, strong EU support)

Is there an existing Infoblox Grid?
  Yes -> Expand with BloxOne (Universal DDI hybrid management)
```

## DDI and Security

DNS is both a critical service and a primary attack vector:

- **DNS tunneling** -- Data exfiltration through DNS queries; both Infoblox and EfficientIP detect this
- **DGA detection** -- ML-based identification of algorithmically generated domains used by malware C2
- **RPZ / DNS firewall** -- Block known-malicious domains at DNS resolution time
- **DHCP fingerprinting** -- Identify unauthorized device types on the network
- **Passive DNS** -- Historical DNS data for threat hunting and forensics

## Migration Guidance

### Spreadsheet to DDI Platform

1. **Audit existing data** -- Collect all IP spreadsheets, DNS zone files, DHCP configs
2. **Normalize** -- Standardize subnet notation, remove duplicates, validate IPs
3. **Import hierarchy** -- Build site/network tree first, then populate IPs
4. **Enable discovery** -- Run network discovery to find active hosts not in spreadsheets
5. **Reconcile** -- Compare discovered vs documented; resolve conflicts
6. **Cutover DHCP** -- Migrate DHCP scopes to DDI platform; failover pair per site
7. **Cutover DNS** -- Migrate zones; use hidden primary pattern for zero-downtime transition
8. **Validate** -- Monitor for 30+ days before decommissioning legacy systems

### Infoblox to EfficientIP (or Reverse)

1. **Export** -- WAPI bulk export or CSV export from source platform
2. **Schema mapping** -- Map extensible attributes / custom fields between platforms
3. **Staged import** -- Import networks first, then records, then DHCP scopes
4. **Parallel operation** -- Run both platforms in parallel with DNS forwarding
5. **Validation** -- Compare resolution results and DHCP lease data
6. **Cutover** -- Switch DNS delegation and DHCP relay agents

## Technology Routing

| Request Pattern | Route To |
|---|---|
| Infoblox, NIOS, Grid, WAPI, BloxOne, Threat Defense, NetMRI, RPZ | the `infoblox` skill |
| EfficientIP, SOLIDserver, DNS Guardian, DNS Blast | the `efficientip` skill |

## Common Pitfalls

1. **No DHCP failover** -- Single DHCP server means network-wide IP assignment failure on server outage. Always deploy in HA pairs.

2. **Spreadsheet IPAM** -- Spreadsheets cannot detect conflicts, enforce allocation policies, or integrate with DHCP/DNS. Migrate to a DDI platform as soon as subnet count exceeds 50.

3. **DNS as security afterthought** -- DNS is the first service malware contacts for C2. Enable RPZ/DNS firewall and monitor DNS query patterns for anomalies.

4. **Ignoring DHCP lease history** -- DHCP lease logs are critical for security incident investigation (who had IP X at time T). Ensure retention meets compliance requirements (typically 90-365 days).

5. **Flat IP addressing** -- No hierarchy makes delegation, summarization, and troubleshooting difficult. Design a hierarchical addressing plan before deploying DDI.

6. **Skipping network discovery** -- Deploying DDI without discovery means the IPAM database is immediately stale. Enable SNMP/ARP/DHCP discovery from Day 1.

## Reference Files

- `references/concepts.md` -- DDI fundamentals: DNS/DHCP/IPAM integration, IP address lifecycle, DHCP fingerprinting, Grid architecture patterns, DNSSEC. Read for "how does X work" or cross-platform conceptual questions.